Implement password reset and forgot-email flows with SMTP (#1327)#1500
Open
tiweb442 wants to merge 9 commits into
Open
Implement password reset and forgot-email flows with SMTP (#1327)#1500tiweb442 wants to merge 9 commits into
tiweb442 wants to merge 9 commits into
Conversation
- Add MAIL_FROM_ADDRESS and MAIL_FROM_NAME to .env.example with SMTP provider hints - Wire up /forgot-password (Fortify) and /forgot-email routes; replace href="#" stubs in login modal - Create styled outgame Blade views for forgot-password, reset-password, forgot-email - Add ResetPasswordMail and RetrieveEmailMail Mailables with OGameX-branded HTML templates - Override User::sendPasswordResetNotification() to use branded mailable - Add ForgotEmailController: looks up user by username, sends masked-email hint, no username-leak - Add i18n keys for all new UI and email strings (EN / IT / NL)
…e URLs - Replace hardcoded /game/reg/mail.php click handlers in outgame JS with navigation to /forgot-password and /forgot-email - Rebuild outgame bundle with updated JS
- Add migration to create password_reset_tokens table (email PK, token, created_at) - Make password reset throttle configurable via AUTH_PASSWORD_RESET_THROTTLE env var (defaults to 60s in production; set to 0 in local .env to disable during development) - Document AUTH_PASSWORD_RESET_THROTTLE and MAIL_FROM_* keys in .env.example
…l clients - Logo was previously loaded via APP_URL (http://localhost in dev), which Gmail cannot fetch - Replace external URL reference with inline base64 data URI for the OGameX icon - Fix incorrect image path (/img/outgame/ → /img/icons/ where the file actually lives) - Also add MAIL_MAILER=smtp to .env.example to prevent emails silently falling back to log driver
…ckground-image, add tests - Remove deprecated MAIL_DRIVER=smtp from .env.example (Laravel 7+, replaced by MAIL_MAILER) - Drop CSS background-image from email templates: Gmail strips it, Outlook ignores it, Apple Mail blocks it — the solid #000000 fallback is now the only background - Add ForgotPasswordTest (5 tests): page load, reset link sent/not sent, valid/invalid token - Add ForgotEmailTest (5 tests): page load, email sent/not sent, masked email, validation
… black copyright - Remove base64 logo image (not rendering in email clients, shows broken icon) - Change outer background from #000000 to #ffffff (white) - Change copyright text color from #425463 to #000000 (black) - Remove deprecated MAIL_DRIVER from .env.example - Fix leftover img tag remnants in reset-password template
…restore test files - Replace inline throttle:5,1 with named 'forgot-email' rate limiter - Limiter returns Limit::none() in testing environment to prevent 429 responses - Keeps 5 req/min limit in production - Restore ForgotEmailTest and ForgotPasswordTest lost during previous amend - Remove deprecated MAIL_DRIVER from .env.example (reviewer feedback)
- routes/web.php: move ForgotEmailController import to the F-section (between FleetEventsController and GalaxyController) - forgot-password.blade.php, reset-password.blade.php: change email input from type=text to type=email for correct mobile keyboard and native browser validation
Co-authored-by: Cursor <cursoragent@cursor.com>
10 tasks
Preview deploymentPreview environment for this PR is ready for functional testing. Use one of the test accounts below to log in.
Test accounts (click to expand)
This preview will be automatically destroyed when the PR is closed. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
main(CONTRIBUTING: branch frommain, one concern per PR)ResetPasswordMail, forgot-email via username lookup with masked address and no username enumerationforgot-emailrate limiter, alphabetized import,type="email"inputs, cleaned email templatesFixes #1327
Relates to
This is a clean replacement for #1375 (fork
piciolo:SMTP), which is currently conflicting withmain. Credit for the original implementation: @piciolo.Test plan
composer run cs -- --testcomposer run rectorcomposer run stanphp artisan test --filter='ForgotEmailTest|ForgotPasswordTest'/forgot-passwordand/forgot-emailrender; login modal links navigate there (not legacymail.php)Made with Cursor